CVE-2026-55557: Browse mcp Browse-mcp Has An Arbitrary File Vulnerability
HIGHCVE-2026-55557 is a HIGH browse-mcp has an arbitrary file vulnerability (CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')) affecting Browse mcp libraries in the npm ecosystem. The issue involves browse-mcp has an arbitrary file write via unconfined download and state paths. Remediation is available by upgrading affected packages to version 0.8.2.
CVE-2026-55557 at a Glance
How to Fix CVE-2026-55557
To remediate this vulnerability, upgrade all affected Browse mcp dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install browse-mcp@0.8.2Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls browse-mcpHow to Check if You Are Affected
To determine whether your Node.js application is affected by CVE-2026-55557, inspect your project dependencies using npm:
npm ls browse-mcpAnalyze the terminal output to locate any version of Browse mcp in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.8.2), your application is affected.
Note: The npm ls browse-mcp command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), where the product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. In Browse mcp, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-55557 Affected Browse mcp Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
browse-mcp
|
npm |
< 0.8.2
|
0.8.2
|
References
Frequently Asked Questions
What is CVE-2026-55557?
Which Browse mcp versions are affected?
What version fixes CVE-2026-55557?
Is browse-mcp affected?
What CWE is associated with CVE-2026-55557?
How can I check npm dependencies for CVE-2026-55557?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-m9mq-7m7q-xc6p",
"modified" : "2026-08-25T16:28:32Z",
"published" : "2026-08-25T16:28:32Z",
"aliases" : [ "CVE-2026-55557" ],
"summary" : "browse-mcp has an arbitrary file write via unconfined download and state paths",
"details" : "### Impact\n`browser_download` wrote a fetched file to `join(save_dir, filename)` with no validation of `save_dir`, and `browser_save_state` / `browser_load_state` honored an explicit `path` unchanged. The MCP caller controls these arguments (a malicious MCP client, or an autonomous agent steered by indirect prompt injection on a visited page), so an attacker could supply an arbitrary `save_dir` (or state `path`) together with a URL whose response body became the file contents, writing attacker-controlled bytes to any path the process can reach (for example `~/.bashrc`, an autostart entry, or a cron file). That is an arbitrary file write that can lead to host code execution. The `force_fetch` fallback additionally used a raw `fetch()` that bypassed the `BROWSE_MCP_ALLOWED_ORIGINS` origin fence.\n\nEstimated severity: CVSS 3.1 around 7.8 (High) for the local / agent-mediated case.\n\n### Patches\nFixed in 0.8.2. `save_dir` is confined under the download root (`~/.browse-mcp/downloads`) and the explicit state `path` under `~/.browse-mcp/state`; absolute paths and `..` escapes are rejected, and download filenames are reduced to a bare basename. `force_fetch` now also honors the origin fence. Data roots remain relocatable via `BROWSE_MCP_HOME`. Upgrade to browse-mcp 0.8.2.\n\n### Workarounds\nRestrict the exposed tools with `BROWSE_MCP_TOOLS` to a set that excludes `browser_download`, `browser_save_state`, and `browser_load_state` (for example the hardened recipe in SECURITY.md). Note that the allowlist hides the tools from an agent but does not stop a malicious MCP client from calling them by name, so upgrading is the real fix.\n\n- Reported privately by novice-22.",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "browse-mcp"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "0.8.2"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 0.8.1"
}
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/That1Drifter/browse-mcp/security/advisories/GHSA-m9mq-7m7q-xc6p"
}, {
"type" : "WEB",
"url" : "https://github.com/That1Drifter/browse-mcp/pull/58"
}, {
"type" : "WEB",
"url" : "https://github.com/That1Drifter/browse-mcp/commit/5352a4a56f626254b445bfa07e4bb48c5aad15c1"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/That1Drifter/browse-mcp"
}, {
"type" : "WEB",
"url" : "https://github.com/That1Drifter/browse-mcp/blob/v0.8.2/CHANGELOG.md#082---2026-06-13"
}, {
"type" : "WEB",
"url" : "https://github.com/That1Drifter/browse-mcp/releases/tag/v0.8.2"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-22" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2026-08-25T16:28:32Z",
"nvd_published_at" : null
}
}